CTFs on MOZA

BugForge – Tanuki

Tue, 13 Jan 2026 00:00:00 +0000

Challenge Info

Challenge Name: Tanuki Scope
Platform: bugforge
Category: Web
Difficulty: Easy
Points: 10
First Blood: moza369 🩸

Challenge Overview

Tanuki Scope is a daily web challenge that simulates a small learning platform.
The application allows users to register and log in, then study different decks such as Technology and Linux Trivia.

After logging in, the dashboard displays progress information like:

Cards studied
Cards mastered
Weekly sessions
Study statistics

The objective was to identify a vulnerability that leads to the flag.

BugForge – Ottergram

Sat, 10 Jan 2026 00:00:00 +0000

Challenge Info

Challenge Name: Ottergram
Platform: bugforge
Category: Web
Difficulty: Easy
Points: 10
Hint: GraphQL

Challenge Overview

The challenge provides a web application called Ottergram. The given hint strongly suggests that the vulnerability lies within a GraphQL endpoint.

The application scope allows access to all paths under:

https://<lab-id>.labs-app.bugforge.io/*

Initial Reconnaissance

While exploring the application, I tested common GraphQL endpoints and discovered that the following endpoint was accessible:

/graphql

BugForge – Shady Oaks Financial

Fri, 09 Jan 2026 00:00:00 +0000

Challenge Info

Challenge Name: Shady Oaks Financial
Platform: bugforge
Category: Web
Difficulty: Easy
Points: 10

Overview

The Shady Oaks Financial application provides a login and registration page. After registering a normal user account, the application issues a JWT token that is stored in the browser.

The goal of this challenge is to escalate privileges and gain admin access.

Initial Access

We begin by creating a normal user account using the registration page and logging in successfully.

Root-me — Master kee

Sun, 16 Mar 2025 00:00:00 +0000

Challenge Info

Platform: root-me
Category: Forensics
Difficulty: Medium
Points: 15
Link: MasterKee

Cracking the MasterKee Challenge: Exploiting CVE-2023-32784

For this challenge, we are provided with two files:

MasterKee.DMP
Masterkee.kdbx

The goal is to extract the password from the .DMP file and use it to unlock the KeePass database (Masterkee.kdbx).

After some research, I discovered that a specific version of KeePass is vulnerable to CVE-2023-32784, which allows extracting the master password from a memory dump.

Root-me — Oh My Grub

Tue, 11 Mar 2025 00:00:00 +0000

Challenge Info

Platform: root-me
Category: Forensics
Difficulty: Medium
Points: 15
Link: Oh-My-Grub

In this challenge, we are given an OVA (Open Virtualization Appliance) file. The goal is to analyze the file and retrieve the login credentials required to access the virtual machine. Here’s how I approached the problem:

Step 1: Extracting Files from the OVA File

The OVA file is essentially a tarball, so we can extract its contents using the tar command:

N7 CTF – CTF Writeups

Sun, 12 May 2024 00:00:00 +0000

N7 CTF

The N7 CTF was a Capture The Flag competition featuring challenges from several categories, including Web, Cryptography, Steganography, and Reverse Engineering.

In this writeup, I will cover the challenges I solved and explain the techniques used to obtain each flag.

Cryptography

Challenge 1 — Custom Encryption

Challenge Overview

For the first crypto challenge, we were given two Python files:

message.py
output.py

The first step was to inspect the encryption algorithm.

CTFs on MOZA

BugForge – Tanuki

Challenge Info

Challenge Overview

BugForge – Ottergram

Challenge Info

Challenge Overview

Initial Reconnaissance

BugForge – Shady Oaks Financial

Challenge Info

Overview

Initial Access

Root-me — Master kee

Challenge Info

Cracking the MasterKee Challenge: Exploiting CVE-2023-32784

Root-me — Oh My Grub

Challenge Info

Analyzing an OVA File to Retrieve Login Credentials

Step 1: Extracting Files from the OVA File

N7 CTF – CTF Writeups

N7 CTF

Cryptography

Challenge 1 — Custom Encryption

Challenge Overview